                                   :volume_size 35
                                   },
                     :snapshot_options { :automated_snapshot_start_hour 23}})
+
+     (vpc-resource "aws_iam_role" "logstash" {:name "logstash"
+                                              :assume_role_policy (json/generate-string {
+                                                                                         "Version" "2012-10-17",
+                                                                                         "Statement" [
+                                                                                                      {
+                                                                                                       "Action" "sts:AssumeRole",
+                                                                                                       "Principal" {
+                                                                                                                    "Service" "ec2.amazonaws.com"
+                                                                                                                    },
+                                                                                                       "Effect" "Allow",
+                                                                                                       "Sid" ""}]})})
+
+     (vpc-resource "aws_iam_role_policy" "logstash"
+                   {"name" "logstash"
+                    "role"  (vpc-id-of "aws_iam_role" "logstash")
+                    "policy" (json/generate-string {
+                                                    "Version" "2012-10-17"
+                                                    "Statement" [{
+                                                                  "Resource" es-arn-*,
+                                                                  "Action" ["es:*"],
+                                                                  "Effect" "Allow"
+                                                                  }
+                                                                 {
+                                                                  "Resource" es-arn,
+                                                                  "Action" ["es:*"],
+                                                                  "Effect" "Allow"
+                                                                  }
+                                                                 ]})})
+
+     (vpc-resource "aws_iam_instance_profile" "logstash" {
+                                                          :name "logstash"
+                                                          :roles  [(vpc-output-of "aws_iam_role" "logstash" "name")]
+                                                          })
+
      (add-key-name-to-instances
       key-name
       (in-vpc (id-of "aws_vpc" vpc-name)

                                                   :subnet_id (vpc-id-of "aws_subnet" "private-a")
                                                   :associate_public_ip_address true
                                                   })


              (elb "kibana" resource {:name "kibana"
                                      :health_check {:healthy_threshold 2

              ;; alerting server needs access to all servers
              (vpc-security-group "nrpe" {})

              (database {:name (vpc-unique "alerts")
                         :subnet vpc-name})

